Server-Side Request Forgery in TiBillet Lespass APIv1

CVE-2026-112358

What is CVE-2026-112358?

A vulnerability has been identified in the TiBillet Lespass APIv1 affecting the get_img_from_url function in the serializers.py file. This flaw allows an attacker to manipulate the img_url/image_url argument, potentially leading to server-side request forgery, allowing unauthorized remote access to the server's internal resources. The complexity of executing this attack is high, making it challenging for attackers, yet the risk remains significant. The vendor is addressing this with upcoming fixes including destination IP validation and enhanced timeout and size limits as part of the v2 API release, which replaces the vulnerable endpoints.

References